CVE-2022-36316

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 103

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1768583Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-28/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1768583Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-28/Vendor Advisory

Timeline

Published: Dec 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-363176.5When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a perman CVE-2022-363185.3When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR CVE-2022-363197.5When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vu CVE-2022-36326.5The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to m CVE-2022-363209.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of me CVE-2022-363216.5In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases CVE-2022-363228.8In JetBrains TeamCity before 2022.04.2 build parameter injection was possible CVE-2022-363239.1Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges CVE-2022-363247.5Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypa CVE-2022-363254.8Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated rem CVE-2022-363264.9An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount CVE-2022-363279.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to